Backup router access - multi-wan multi-router with IPsec VPN

[Thale]

We have an issue accessing our backup router for a multi-wan multi-router CARP configuration from another location on our network.  We use IPsec VPN tunnels to connect our different locations.  I found information regarding a fix for this issue with references to https://doc.pfsense.org/index.php/CARP_Secondary_Unreachable_Over_VPN which essentially describes our scenario exactly.  My question comes regarding these instructions - unfortunately, I find the description of the solution somewhat vague.  The NAT configuration that needs set up on the LAN - does that need to be set up on the primary router for traffic going out its LAN to the secondary router, or set up on the secondary router for traffic going out to the primary?  As near as I can tell, it's on the primary router's LAN when headed to the secondary, but it doesn't seem to be working.

Also, would a firewall alias that includes both the primary and secondary routers' LAN IP addresses in it work as the target to enable a single rule covering traffic no matter which router has CARP control with the active IPsec connection?  Or do we really need to do 2 separate rules?

Thanks!